CVE-2007-1358

描述

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

如何修補 CVE-2007-1358

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• Maven/org.apache.tomcat:tomcat—未列出修補版本

CVE-2007-1358 正在被利用嗎?

中等 — EPSS 為 19.9%,可持續追蹤但非最高優先。

受影響套件(1)

• >= 4.0.0, <= 4.0.6

參考連結(10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2007-1358
• WEBdocs.info.apple.com/article.html?artnum=306172
• WEBlists.apple.com/archives/security-announce//2007/Jul/msg00004.html
• WEBrhn.redhat.com/errata/RHSA-2008-0630.html
• WEB